MalShare

SHA256 Hash	File type	Added	Source	Yara Hits
7bea797e233b6f2885014e7806778a5a5bb20773458b6ff92c2aae058e808020	PE32	2022-03-14 18:02:18	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/MinGW_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/vmdetect YRP/antisb_sandboxie YRP/Big_Numbers1 YRP/spyeye YRP/XtremeRATStrings YRP/XtremeRAT
6861608d41d29db74c341f009591069d467ee8ac3d56a6d78edd972a121816ad	PE32+	2022-03-12 02:26:50	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
837a474947d80d86f1d35a59dbef26a14d184d015648b1e1d79937942a9eda44	PE32	2022-03-06 19:01:38	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_CompareCall YRP/Delphi_Copy
eb391db00959504e04be81e0ffbf3c18b1216d0995b3a44d25e2956e4d391e17	PE32+	2022-03-06 02:50:23	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/antisb_sandboxie YRP/win_token YRP/win_files_operation
615e9c81d4b1d9083765da48b995cb1d0ec5a0f68f493a5d16129bbe03668a2c	PE32+	2022-03-06 02:50:16	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_listen YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library
6256f83fab76ac6aa06ee1ac0cdb5080ba5879e943443ec55ccd748104651b4a	PE32+	2022-03-06 02:50:06	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
9207faacac269cad8b0ab6d6f66cd810e53e89aecda188a64694963f78d9163b	PE32+	2022-03-06 02:49:56	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_socket YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Http_API
f40ad9619bd37b129df97423a8cdbebbc2f40e81231cacef759144b923ff5e44	PE32+	2022-03-06 02:49:43	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
8ef995a50a7830acae2da50e2f838c9e634de0ada90751f76dafd2f0d9bff7ce	PE32+	2022-03-06 02:49:37	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
b5d60d4c5d69b17e7e30b23d09b62c973aa170b0185ee5c8d23e0127f02cb095	PE32	2022-02-23 15:43:58	User Submission	YRP/UPXv20MarkusLaszloReiser YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/HasOverlay YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/WMI_strings YRP/Obfuscated_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__RemoteAPI YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_bios YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/BASE64_table YRP/UPX YRP/suspicious_packer_section
ccec681be7ddecc8a09a3e418d0fead28688a2814c50b2726658d8762c58b9e2	PE32	2022-02-22 18:44:46	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/ThreadControl__Context YRP/antisb_sandboxie YRP/antivm_vmware YRP/disable_dep YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/escalate_priv YRP/keylogger YRP/sniff_audio YRP/cred_ff YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API
37b88a783a39c8217291509309c4154bd80cd1c7b581a41f2f4a0c6aca82f990	PE32	2022-02-19 05:39:34	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
627878036b7488ebda481007d92efaac84f9843da2bd6c1c6bd94d18a2cdc431	PE32	2022-02-18 23:14:48	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry YRP/win_files_operation
52fda2b7ddb3ffa3420a78fd134c37f2403b69bd15cb80d19290ec8a1421630c	PE32	2022-02-18 06:51:17	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerCheck__RemoteAPI YRP/vmdetect YRP/Check_Debugger YRP/anti_dbg YRP/antisb_sandboxie YRP/win_registry YRP/vmdetect_misc
feadfb592e58fdd9db1de2bb384ef5031fc79d8bede991f5308b49145334e947	PE32	2022-02-18 06:27:40	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/escalate_priv YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/Delphi_CompareCall YRP/Delphi_Copy
a675aeed123283fd09f692ba204728283f519a44432fa1792a13a87d770cc606	PE32	2022-02-18 05:52:46	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/antisb_sandboxie
141f9470d9d776207e0fd68ae50076204aab501286ce090f78bb5abe927f241f	PE32	2022-02-18 05:05:31	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/antisb_sandboxie YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
0f6dbbd33f333545a147c4b54c2d735a50005b139f60d6d9b8ccd3b40aa362d8	PE32	2022-02-18 03:57:15	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/Check_VBox_Description YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/antivm_bios YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/Typical_Malware_String_Transforms FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
27957fd928f704965dd45e5178e549ecbed08a791d3ecb28284f9ba43f2c7dd3	PE32	2022-02-18 03:28:32	User Submission	YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ [+] YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/Check_Dlls YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy FlorianRoth/Typical_Malware_String_Transforms
43e54c165d545b0a6566fcc8e70fc03b2f2053f720589c2c6d42fa089e82acc8	PE32	2022-02-18 02:25:46	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
5116c025903794c57640f12b9d8adb5ad349d3d429b3f4af02d5e99d30ec2da5	PE32	2022-02-18 01:14:52	User Submission	CuckooSandbox/vmdetect YRP/Borland YRP/D1S1Gv11betaD1N YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
f9597426c7d6a9816221257bd86870c6037c23e4bd2124394909ba58b5f18d1a	PE32	2022-02-17 23:39:10	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
4f1ae7819e7ad9704b7a7a52e7e7f304dd0b0f24277b0b1b6b4b6e3005547c4a	PE32	2022-02-17 22:28:24	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt
13ad8803557d136bb57e1b1f0008b13eec31f824c173243dcdee70c4e46dc9d5	PE32	2022-02-17 21:52:17	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex FlorianRoth/DragonFly_APT_Sep17_3
3da2fae9dae72853bb5922f236d604460be7e9f35c6fd432858370f886e42d7e	PE32	2022-02-17 20:50:41	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/vmdetect YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex YRP/win_registry
1c289f9aeb483881a663bc4abdf127fcdd667d458de35990bcdca2008924fca2	PE32	2022-02-17 20:25:02	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
aceb80e192bf94afb5869ef2d933554518435bc953e032971a9b83eacc181cea	PE32	2022-02-17 19:52:07	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
379e30177f30382892612aec08a71e756e84928fbc5ca8193f58180cb8ca3f1a	PE32	2022-02-17 17:52:28	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
943180700d7a34c29084c60aa364f846da65ebd7e40ae70a2bfe9a5b8e15613c	PE32	2022-02-17 16:47:47	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ [+] YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerCheck__RemoteAPI YRP/Check_Dlls YRP/vmdetect YRP/Check_Debugger YRP/anti_dbg YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_files_operation YRP/vmdetect_misc FlorianRoth/DragonFly_APT_Sep17_3
12de9aaa4d220faf2a6e103d365ee2745d4311b12419866b3f10c9289ea40cee	PE32	2022-02-17 15:51:14	User Submission	CuckooSandbox/vmdetect YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Installer_VISE_Custom_additional [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Installer_VISE_Custom YRP/Armadillo_v4x YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/Check_Dlls YRP/vmdetect YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_mutex YRP/win_files_operation
fea601e019cfa0ddfb0fa2bb3e2182652f08c207dc3b4d10b1c6407497b44742	PE32	2022-02-17 14:19:42	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry YRP/win_files_operation
33611f5cf9c87ab459052b0ab0de62c184140ba414da16e0c788b9529737f0a8	PE32	2022-02-17 13:47:54	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
66e58ae7bc60cce88a3aa7a455c883d2f4c492254801fb6a186a292ae935754a	PE32	2022-02-17 11:45:42	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
ec37f67fbf0b97618fef043f07728c4a3475db85ead807f18562231bbcd21137	PE32	2022-02-17 11:44:05	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry
f601e21f7820ea4225926f9a2a0bd4c7373a6e5a8bfa181ac7dcbfc10576ab40	PE32	2022-02-17 10:57:56	User Submission	YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ [+] YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/Check_Dlls YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
3538e77e13ad08d16d761593b8d2d7e35db0fbb03fe14d0ef5d07753d3a18b71	PE32	2022-02-17 10:51:16	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
f0701ecae15c65f23eecdab3a790827e02403c02e1f03f7ad1cfac1b3e27a8bd	PE32	2022-02-17 09:13:51	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
751e90ff3721555f0f026295228c523e2f8c8bab4b80535d482b118a4e26f1f8	PE32	2022-02-17 08:29:30	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
22118efa8e625a56d1d7fe6fec959959a3ef2bae9cf9d0b8cbf3a4c304ad42af	PE32	2022-02-17 08:11:05	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC [+] YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
5f58e60d70595fa58a3a85e62d5d9eb21a7fcce81bee2bbc8c13953a9165d08b	PE32	2022-02-17 07:33:10	User Submission	CuckooSandbox/vmdetect YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional [+] YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/Check_Dlls YRP/vmdetect YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antivm_vmware YRP/disable_firewall YRP/network_udp_sock YRP/network_tcp_listen YRP/network_irc YRP/network_http YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/spreading_file YRP/rat_rdp YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/CRC32_poly_Constant YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
fe311da1f0aabd8a5f8e667b04956d888ed976a14741b9743f4f7b88dc83942b	PE32	2022-02-17 05:15:31	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
05c7ffac0ebdfbdfb1a87b0f117197ab351be41ad79bfd6b8263f32bf5b630bf	PE32	2022-02-17 03:30:20	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
468e7bf4683f3683ead964271f0ff17902c0458040689431d8d8e9ba40b121c0	PE32	2022-02-17 01:17:58	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
74e015b40466991479494d380d2ebaaeb19e37700a0236ff054ffeb00d1ae5f5	PE32	2022-02-17 01:16:01	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Check_Dlls YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antivm_vmware YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy
b501a88bc7ef59905977a817c10dea64640a2c7237c57882359e87795d88b720	PE32	2022-02-17 00:36:27	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50v60 YRP/Microsoft_Visual_Basic_v50 YRP/Microsoft_Visual_Basic_v50_v60 [+] YRP/Microsoft_Visual_Basic_v50_additional YRP/Microsoft_Visual_Basic_v50v60_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/SEH__vba YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
181800ca366eaaa6a0c17c7eaa17f5fec2fe3c2227658f62740791f71ad4c1ff	PE32	2022-02-16 23:16:34	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex YRP/suspicious_packer_section
bec53e06e0bc058045997c468b56e63f741bb1544be9748fcdf6e8cc9202890d	PE32	2022-02-16 23:11:09	User Submission	CuckooSandbox/vmdetect YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional [+] YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/Check_Dlls YRP/vmdetect YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antivm_vmware YRP/disable_firewall YRP/network_udp_sock YRP/network_tcp_listen YRP/network_irc YRP/network_http YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/spreading_file YRP/rat_rdp YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/CRC32_poly_Constant YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
47f3284ae6d491342d1d384d7ed33ed889402af2c6e0f6ee850ae3b1b69c8bbb	PE32	2022-02-16 21:18:18	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/antisb_sandboxie YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
26576f35cc4d31cc498e668e9b7a8cc6b4113bd5712c6c5f2e7d9cd6356bc319	PE32	2022-02-16 20:27:45	User Submission	YRP/MingWin32_GCC_V3X YRP/MingWin32_GCC_3x YRP/MingWin32_v_h_additional YRP/MinGW_GCC_3x_additional [+] YRP/MinGW_GCC_3x YRP/MingWin32_GCC_3x_additional YRP/MingWin32_v_h YRP/MingWin32_v YRP/MinGWGCC3x YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/MinGW_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/Big_Numbers0 YRP/Big_Numbers1
6fcfdae466a526d417a053205db10b19d858fe255f86283059f8f2fc970cb8ec	PE32	2022-02-16 19:28:32	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/DarkComet_1
ec5c338dc21fde47c31e6a1ab1cf0c68a8715700bd2de9d7c36bc4bb4b75df58	PE32	2022-02-16 19:14:04	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
ebc84a5a8d6321b725c318f32e2bf1eb926ad917c82d0f31bafaa2c0e3e6c2a4	PE32	2022-02-16 18:51:20	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
ea573f1271b1394aebe9a6a9464cc13965730b95b591e67f76c686e546967fc9	PE32	2022-02-16 18:39:22	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC [+] YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasModified_DOS_Message YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
7fa8841b47d8960ea461ce5aad0bcb81179a0f54fcd21b450c29ac4c6d559a62	PE32	2022-02-16 18:24:31	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex FlorianRoth/DragonFly_APT_Sep17_3
3a441453924d5911b241f265f361729c3ab6d79cf19c8b76b17fc1f020b55274	PE32	2022-02-16 17:01:54	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex FlorianRoth/DragonFly_APT_Sep17_3
f4a5335ab39c5ac80ce67d737ec9ea1c3ab3f0e4d62735568009fd2ee7a58fbf	PE32	2022-02-16 15:23:40	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/ProtectSharewareV11eCompservCMS YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/SEH__vba YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_Copy
f3923ddf08e10c42f07182a1d3eea76324ffb247800f63f2405c3bb7b38fef31	PE32	2022-02-16 13:07:27	User Submission	YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ [+] YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/Check_Dlls YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
be2cb75049def7afcbd979674225cd7eb62d88643bb08e5009167ac85fbab1ce	PE32	2022-02-16 11:27:17	User Submission	CuckooSandbox/vmdetect YRP/Petite_v22_Compresor_wwwun4seencompetite YRP/PEtite_v21 YRP/FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional [+] YRP/Petite_v21_2_additional YRP/Petite_v22_wwwun4seencompetite_additional YRP/PackerPetite_v22_Compresor_wwwun4seencompetite YRP/Petite_v22_wwwun4seencompetite YRP/PEtite_v21_additional YRP/Petite_v21_2_Hint_WIN_EP YRP/Petite_v21_2 YRP/PEtite_v21_Ian_Luck YRP/Borland YRP/Petite21 YRP/Petitev212 YRP/PEtitev21 YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/IsBeyondImageSize YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
e92b2f405839b577d7317750967f851039649513c5b24611894f4665486e767b	PE32	2022-02-16 09:00:36	User Submission	CuckooSandbox/vmdetect YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerCheck__RemoteAPI YRP/vmdetect YRP/Check_Debugger YRP/anti_dbg YRP/antisb_sandboxie YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/BASE64_table
4b3614bd371bbe9b080be656827db95aa84203748ea4d6a533cdd8a6927ff028	PE32	2022-02-16 04:13:57	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Obfuscated_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry YRP/win_files_operation
7df798efb99fb1058de182e410781529e8480185d115f816a9a4acb6f91bd601	PE32	2022-02-16 02:33:02	User Submission	CuckooSandbox/vmdetect YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry YRP/win_files_operation
29f454afc4d81be97f043fea434e6bcda1a293a339358c06c47118fa5622c1a8	PE32	2022-02-16 01:34:47	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_sandboxie YRP/antivm_vmware YRP/win_registry YRP/win_files_operation YRP/Big_Numbers0
2fb327f002d91d2b6539cdc2e5133564b296d196186f8121d3363b270afb38c8	PE32	2022-02-15 23:38:07	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/DarkComet_1
dbdcd0c4a03f9b60d8e9f99479b72b6c40451866a04df04bbfddb5cf1df083b1	PE32	2022-02-15 22:38:57	User Submission	CuckooSandbox/vmdetect YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional [+] YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/Check_Dlls YRP/vmdetect YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antivm_vmware YRP/disable_firewall YRP/network_udp_sock YRP/network_tcp_listen YRP/network_irc YRP/network_http YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/spreading_file YRP/rat_rdp YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/CRC32_poly_Constant YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
c95b9232a5679d42b176733d0dea9a40b2b762272f13e54830c2529ced8f53ab	PE32	2022-02-15 21:48:06	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
1d4006c28cea3760cb53812a613ffc94d2d98546ebfc6e71292e608b336e142b	PE32	2022-02-15 20:28:36	User Submission	YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay [+] YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
c644511a00b6587202705223cec6e059f69aeeabfa25746191e89783e00d15bd	PE32	2022-02-15 20:02:20	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/ThreadControl__Context YRP/Check_Dlls YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/win_mutex
15758e91ed9bbead48c23b487dc945343532b898a6bb0639160850df4e8c4817	PE32	2022-02-13 15:01:04	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
cfbfb09fdb46538fd62e3206e2618afdf1f641bf16aa2a6d1c9b1ac7b4032a53	PE32+	2022-02-08 02:08:30	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_socket YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Http_API
02b3876a4dbd047b272cdfe154cae4bee131a3ef3841c058edf45ec7d113110b	PE32+	2022-02-08 02:03:04	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/anti_dbg YRP/antisb_sandboxie YRP/win_mutex YRP/win_token YRP/win_files_operation
67bcd219f86dd1e243282dfad492c1aa5b262b2bdc8ec921e74cfb16662d7dee	PE32+	2022-02-08 02:02:54	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_listen YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library
8b30745e9e064845971da0b43e9a1a28c5b882a7b13e88e5b671e1639cf8b483	PE32+	2022-02-08 02:02:38	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
fed93ab20863ca878eba9f96d40aaab5bb0715143e7a3acf4d408228f8178ff4	PE32+	2022-02-08 02:02:30	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/antisb_sandboxie YRP/win_token YRP/win_files_operation
f704a1165804f14b0c4f5520d73352d326037308d6ecb4de66d68c01c1c78eb7	PE32+	2022-02-08 02:02:20	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
c7c3c5f7dc4c4cc2710ad8c0b70a62143ecaaa8d19e88f9cf4a569b582912765	PE32+	2022-02-08 02:02:04	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
d5d886bcc380704109bba8b6da5e942a6781b9d27ac5f31ceabb8b6aa377e4d0	PE32+	2022-02-04 02:37:18	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
a09adead6aa7b7e460d5dfdcac6798bcab777267e2449106e45b358ef2f80bb5	PE32+	2022-02-02 02:03:19	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_socket YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Http_API
174b42d912ecd387ecf0842d6b000ae9965fd0d858ae60ccbd2e302775da1b2f	PE32+	2022-02-02 02:03:07	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
4eded32dadfb3a9df15b0b7fbe125e32f4b74a37a3530bcc673c82ae4ded9ddd	PE32+	2022-02-02 02:01:04	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
633e6001e1fe657fb3e8540370ee2f88e8cd08dc7ddf7f767fbe03fc118326c2	PE32+	2022-01-19 02:06:17	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
f256a25d926a5549154fa40266a7eea662d26fc798cc505c53938f7fa07d4ec9	PE32+	2022-01-09 02:00:40	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_socket YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Http_API
adb52a2bc6601f1f569ba50ea1625ad449dc400a3e4e1725973d95aac0401a53	PE32+	2022-01-09 02:00:32	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
e6545821db3a6d2d82021dcb4e97811813abd183e61953139f25adbfabb28f14	PE32+	2022-01-09 02:00:28	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
8ee30990f1667454b11233eb08689204409010441b51faa83d335db65b2ece47	PE32	2021-12-20 09:03:41	User Submission	YRP/Microsoft_Visual_Basic_v50v60 YRP/Microsoft_Visual_Basic_v50 YRP/Microsoft_Visual_Basic_v50_v60 YRP/Microsoft_Visual_Basic_v50_additional [+] YRP/Microsoft_Visual_Basic_v50v60_additional YRP/NETDLLMicrosoft YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/ThreadControl__Context YRP/SEH__vba YRP/antisb_sandboxie YRP/antivm_vmware YRP/disable_dep YRP/inject_thread YRP/network_smtp_dotNet YRP/network_dropper YRP/network_tcp_socket YRP/escalate_priv YRP/keylogger YRP/sniff_audio YRP/cred_ff YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/Njrat YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API
6fca1373b5283f86571457d18f24ae2dd7035ca34d2261601fdebb08857985f3	PE32+	2021-11-21 02:29:04	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
62fdd3da594759d2f294c1c4e0bfb1cbb7a37f62e894d94c5a4e91137a4f4462	PE32+	2021-11-21 02:28:57	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
90dc46d88dda313b3986d787828ca57e44dd88ffa14f46631ec89f883a8baf64	PE32+	2021-11-04 02:39:30	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_socket YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Http_API
8427bb70d73e3dea1cd0dbbae2741ba84d8324499739dac6aee4342f1bba8e19	PE32+	2021-11-04 02:28:40	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
767d97fa547d20cdc69c3cfe9ef306f5d8285ad3e922f7c07f4fe2a53348daf7	PE32+	2021-11-04 02:28:33	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/screenshot YRP/keylogger YRP/win_files_operation
3a14493f4e08a4babd3554764f35aafeefd7b6d2a5e3294acbc0da46e9b3260d	PE32+	2021-11-04 02:07:00	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/anti_dbg YRP/antisb_sandboxie YRP/win_token YRP/win_files_operation
dc9a5d132932959926dfd8e9d24decc134f5b57b69dacc963fc0c8cade885abc	PE32	2021-11-04 02:06:49	User Submission	YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
8efdfc805246f9cd99f2054a0aedc5a482a32debe3b9529aab5909735d2c8a07	PE32+	2021-11-04 02:00:56	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_listen YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library
58b608268a4f98e9e81a82c981343ed68ea21dcb3a5d68ae15f36c787af617df	PE32+	2021-11-04 02:00:50	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/antisb_sandboxie YRP/win_token YRP/win_files_operation
03d6e1cdd15444370e746f2114db0013806ca5329bbca775239767a0e9acb998	PE32+	2021-11-04 02:00:44	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
6e240a6e220177c99ca59bc4ed9181c64a32590f7d664047a61efcbae9cdc472	PE32+	2021-11-04 02:00:37	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/anti_dbg YRP/antisb_sandboxie YRP/win_mutex YRP/win_token YRP/win_files_operation
7c4e0e8533b1e1b0299766f2a6db4d6dc5ba277cf776ae84517d64199e0a9652	PE32	2021-10-31 21:00:27	User Submission	YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 [+] YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/ThreadControl__Context YRP/antisb_sandboxie YRP/antivm_vmware YRP/disable_dep YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/escalate_priv YRP/keylogger YRP/sniff_audio YRP/cred_ff YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API
0dd880f9d81bdde7dd3f7147507ec839214daf93784c9b900891bffe1e8d2947	PE32+	2021-10-31 02:01:01	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/escalate_priv YRP/win_registry YRP/win_token YRP/win_files_operation
02967baa11379cc9051d7c876bfc8bfd035fe8de9ea955e01ac3e1d7671e62a9	PE32+	2021-10-29 01:18:15	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/Check_Dlls YRP/anti_dbg YRP/antisb_sandboxie YRP/disable_dep YRP/escalate_priv YRP/screenshot YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Advapi_Hash_API
228361e5d4d13708f3ef218e0e0bf319d851fec622dc4cc116d03b0314c738e5	PE32+	2021-10-25 04:22:38	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/anti_dbg YRP/antisb_sandboxie YRP/network_tcp_listen YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library
3d62f1cb72350c04dc9fcac4345f5c1e4e26b7849365b1a45e56f78bb7faf413	PE32+	2021-10-25 04:22:35	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/antisb_sandboxie YRP/win_token YRP/win_files_operation

Recent Searches
yrp/antisb_sandboxie
yrp/ispe32
yrp/exe_additional
yrp/ip
yrp/hasrichsignature
yrp/iswindowsgui
yrp/upx_290_lzma_markus_oberhumer_laszlo_molnar_john_reiser
yrp/borland_delphi
yrp/win_files_operation
yrp/ip

Search

Recent Searches